Agent skill · data analytics · elastic
observability-llm-obs
Answer questions about LLM and agentic-application behavior from data already ingested into Elastic: latency and error rate, token and cost utilization, response quality and guardrail events, and agentic call-chain orchestration. Use when the user asks about LLM monitoring, GenAI observability, token spend or AI cost, model latency, prompt or guardrail failures, or how an agent's tool-call chain executed.
Why this skill is useful
Provides specific query patterns and integration metrics for monitoring LLM performance and costs that the AI wouldn't reliably generate on its own.
What it needs
About 11k tokens when loaded. Last updated 2026-07-22. 546 stars on the source repository.
What this skill does
LLM and Agentic Observability Answer questions about monitoring LLMs and agentic components using data actually ingested into Elastic — nothing else. The four questions this skill answers are LLM performance, cost and token utilization, response quality, and call chaining or agentic workflow orchestration. A given deployment typically uses one or more ingestion paths: APM/OTLP traces, and/or integration metrics and logs. Which one exists is a discovery result, not an assumption — never assume both are present. For ES QL syntax, commands, and query patterns, use the elasticsearch-esql skill. For service-level latency and error triage that is not LLM-specific, use the observability-sre-triage skill. <!-- begin-partial: preamble --> Environment Configuration This skill executes Elasticsearch operations through the elastic CLI. If the elastic CLI is not installed, tell the user what it is needed for. Do not guess credentials, call the HTTP API directly, or attempt other workarounds. This skill references operations in HTTP-shorthand form (e.g., GET /, GET /cat/indices, GET /{index}/mapping, GET /{index}/settings/index.mode, POST /query). The Operations table at the end of this document maps each shorthand to the equivalent elastic CLI command — always use the CLI rather than calling the HTTP API directly. <!-- end-partial: preamble --> Analysis without cluster access The CLI check above gates querying the cluster — it does not gate analysis. When the user has already supplied the evidence in their question (metric values, counts, status reasons, log lines, alert payloads, configuration), reason from that evidence and deliver the conclusion. When you genuinely do need data the user has not provided, still say what you would check and how — name the specific query, index, and field that would settle the question — and then ask for CLI setup. An answer that names the check is useful without a cluster; one that only asks for setup is not. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills elastic/llm-obs